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Abstract 

Faugere's F5 algorithm computes a Grobner basis incrementally, by computing a sequence 
of (non-rcduccd) Grobner bases. The authors describe a variant of F5, called F5C, 
that replaces each intermediate Grobner basis with its reduced Grobner basis. As a 
result, F5C considers fewer polynomials and performs substantially fewer polynomial 
reductions, so that it terminates more quickly. We also provide a generalization of 
Faugere's characterization theorem for Grobner bases. 
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1. Introduction 

Grobner bases, first introduced in (Buchberger, 1965), are by now a fundamental tool 
of computational algebra, and Faugere's Fo algorithm is noted for its success at comput- 
ing certain difficult Grobner bases (Faugere, 2002; Bardet et al., 2003; Faugere, 2005). 
The algorithm's design is incremental: given a list of polynomials F = (/i, . . . , /„), F5 
computes for each t = 2, . . . , m a Grobner basis Gi of the ideal {Fi) = (/i, . . . , fi) using a 
Grobner basis Gj_i of the ideal The algorithm assigns each polynomial p a "sig- 

nature" determined by how it computed p from F; using the signature, F5 detects a large 
number of zero reductions, and sometimes avoids these costly computations altogether. 

This paper considers the challenge of modifying F5 so that it replaces Gi-i with 
its reduced Grobner basis Bi-i before proceeding to (Fi). Working with the reduced 
Grobner basis is desirable because each stage of the pseudocode of (Faugere, 2002) usually 
generates many polynomials that are not needed for the Grobner basis property, and there 
is no interreduction between stages. In one example, we show that a straightforward 
implementation of the pseudocode of (Faugere, 2002) on Katsura-9 concludes with a 
Grobner basis where nearly a third of the polynomials are unnecessary. 

Stegers introduces a variant that uses Bi-i to reduce newly computed generators of 
{Fi) (Stegers, 2006). We call this variant F5R, for "F5 Reducing by reduced Grobner 



* Corresponding author 

Email addresses: ederc8mathematik.uni-kl.de (Christian Eder), john.perrySusm.edu (John 
Perry) 

URL: uuu.math.usm.edu/perry (John Perry) 
Preprint submitted to Elsevier July 21, 2009 



bases." However, F5R still uses the unreduced basis G^-i to compute critical pairs and 
new polynomials for Gj. As Stegers points out, discarding Gi_i in favor of is not a 
casual task, since the signatures of G,_i do not correspond to the polynomials of -Bi_i. 

The solution we propose is to generate new signatures that correspond to which 
generates the same ideal as Fi^i. With this change, we can discard Gi_i completely. The 
modified algorithm generates fewer polynomials and performs fewer reduction operations. 
Naturally, this means that the new variant consumes less CPU time, as documented in 
two different implementations. Although it is a non-trivial variant of F5, it respects its 
ancestor's elegant structure and modifies only one subalgorithm. We call this variant 
F5C, for "F5 Computing by reduced Grobner bases." 

After a review of preliminaries in Section 2, we describe FoC in Section 3, and provide 
some run-time data. A preliminary implementation in Singular is complete (Greuel 
et al., 2005), and we present comparative timings for Fo, FoR, and FoC. A proof of 
correctness appears in Section 4, and in Section 4.4 we show that one of Faugere's criteria 
is a a special case of a more general criterion. 

The authors have made available a prototype implementation of F5, F5R, and F5C 
as a Singular library (Greuel et al., 2005; Greuel and Pfister, 2008) at 

http: //www. math. usm. edu/perry/Research/f 5_library . lib . 

A prototype implementation for the Sage computer algebra system (Stein, 2008) devel- 
oped by Martin Albreclit, with some assistance from the authors, is available at 

http : //bitbucket . org/malb/algebraic_attacks/src/tip/f 5 .py . 

This latter implementation can use F4-style reduction. 

2. Background Material 

This section describes the fundamental notions and the conventions in this paper. 
Our conventions differ somewhat from Faugere's, partly because the ones here make it 
relatively easy to describe and implement the variant F5C. 

Let F be a field and TZ = ¥ [xi,X2, . . . , a;„]. Let <t denote a fixed admissible ordering 
on the monomials M of TZ. For every polynomial p G TZ we denote the head monomial of 
p with respect to <t by HM (p) and the head coefficient with respect to <y by HC (p). 
(For us, a monomial has no coefficient.) Let F = (/i, /2, . . . , fm) G TZ"^. The goal of F5 
is to compute a Grobner basis of the ideal / = (F) with respect to <t- 

2.1. Grobner bases 

A Grobner basis of / with respect to <t is a finite list G of polynomials in / that 
satisfies the properties (G) = I and for every p Q I there exists g £ G satisfying HM {g) \ 
HM {p). Grobner bases exist for any ideal of TZ, and Buchberger first found an algorithm 
to compute such a basis (Buchberger, 1965). We can describe Buchberger's algorithm in 
the following way: set G = F, then iterate the following three steps. 
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Choose a critical pair p,q ^ G that has not yet been considered, and construct its 
S-polynomial 



S = Spol (p, q) = HC {q) ap^q • p - HC {p) aq^p ■ q 



where 



Icm (HM(p) ,HM {q)) 
HM(p) 



and a. 



lcm(HM(p),HM (g)) 
HM {q) 



We call p and q the generators of S and ap^q ■ p and aq^p ■ q the components of S". 



• Top-reduce S with respect to G. That is, while t = HM (5) remains divisible by 
u = HM (ff) for some g e G, put S := S - | • g. 



• Once no more top-reductions of S are possible, either 5 = or HM (S) is no longer 
divisible by HM (g) for any g E G. 

— In the first case, we say that Spol (p, q) reduces to zero with respect to G. 

— In the second case, append S to G. The new entry in G means that Spol (p, q) 
now reduces to zero with respect to G. 

The algorithm terminates once the S'-polynomials of all pairs p,q G G top-reduce to zero. 
That this occurs despite the introduction of new critical pairs when S does not reduce to 
zero is a well-known consequence of the Ascending Chain Condition (Becker et al., 1993; 
Cox et al., 1997). 

In this paper we consider several kinds of representations of a polynomial. Let G and 
h be lists of m elements of 7?., p € (G), and f g M. We say that 

• h is a G -representation of p if p = higi + • • • + hmQm'i 

• h is a t-representation of p with respect G if h is a G- representation and for all 
fc = 1, . . . , m we have /i^ = or HM {hugk) <t t\ and 

• h is an S -representation of S = Spol(g, , g^) with respect G if h is a t-represen- 
tation of S with respect to G for some monomial t <t 1cm (HM (g^) , HM {gj)). 

We generally omit the phrase "with respect to G" when it is clear from context. 

If p top-reduces to zero with respect to G, then it is easy to derive an HM (p)-repre- 
sentation of p, although the converse is not always true. Correspondingly, if p is an 
iS-polynomial and p top-reduces to zero with respect to G, then there exists an S'-repre- 
sentation of p. 

Theorem 1 summarizes three important characterizations of a Grobner basis; (C) is 
from Buchberger (1965), while (D) is from Lazard (1983). The proof, and many more 
characterizations of a Grobner basis, can be found in (Becker et al., 1993). 

Theorem 1. Let G be a finite list of polynomials in TZ, and <t an ordering on the 
monomials of TZ. The following are equivalent: 



(A) G is a Grobner basis with respect to <t- 
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Algorithm 1 BASIS 
1: globals r, Rule, <t 
2: inputs 

3: F = (/i, /2, . . . , /m) e 7^'" (homogeneous) 
4: <, an admissible ordering 

5: outputs 

6: a Grobner basis of F with respect to < 
7: do 

8: <t:=< 

9: Sort F by increasing total degree, breaking ties by increasing head monomial 

— Initialize the record keeping. 
10: Rule := List (List ()) 

11: r:=List() 

— Computo the basis of (/] ). 

12: Append (Fi,/i-HC(/i)-') tor 

13: Gprev = {1} 
14: S = {/i} 

— Compute the bases of (/i, /2), . . . , (/i, /2, . . . , /m). 
15: i :=2 

16: while i < m 

17: Append (F„/i-HC(/i)-') to r 

18: Gcurr := INCREMENTAL_ BASIS {i, B, Gprev) 

19: if 3A e Gcurr such that Poly (A) = 1 
20: return {1} 

21: Gprev • — G^urr 

22: B := {Poly (A) : A e Gprev} 

23: i:=i + l 
24: return B 



(B) For all nonzero p e (G) there exists g € G such that HM (g) \ HM {p). 

( C) For all p,q € G Spol (p, q) top-reduces to zero with respect to G. 

(D) For all p,q G G Spol (p, q) has an S -representation with respect to G. 

2.2. The F5 Algorithm 

In this section we give a brief overview of F5 (Algorithms 1-10). To make the presen- 
tation of F5R and F5C easier, we have made some minor modifications to the pseudocode 
of Faugere (2002); Stegers (2006), but they arc essentially equivalent. 

The F5 algorithm (Faugere, 2002) consists of several subalgorithms. 

• The entry point is the Basis. It expects as input a list of homogeneous polynomials 
ofTZ. Basis invokes Incremental_Basis to construct Grobner bases of the ideals 
{F2), (-F3), {Fm), in succession. (Computing the Grobner basis of {Fi) is 
trivial.) Polynomials are stored in a data structure r, whose details we consider in 
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Algorithm 2 Incremental_Basis 



1: globals r, <t 

2: inputs 

3: i G N 

4: B, a Grobner basis of (/i, /2, . . . , /i-i) with respect to <t 
5: Gprev C N, indices in r of B 

6: outputs 

7: Gcurr, indices in r of a Grobner basis of (/i, /2, • • • , /i) with respect to <t 

8: do 

9: curr _idx := =ffr 

10: Gcurr := Gprev U {cUrr _idx} 

11: Append List () to Rule 

12: P := UjgG „v CRITICAL_PAIR(curr_ida;,j, i, Gprev) 

13: while P ^ 

14: d := minjdegt : (t, k,u,i,v) € P} — See Algorithm 3 for structure oi p G P 
15: Pd := {if. k,u,i,v) G P : d = degt} 

16: P := P\Prf 

17: 5 := COMPUTE_SPOLS (Prf) 

18: i? := Reduction {S, B, Gprev, Gcurr) 

19: for fc G P 

20: P := PU (UjeGourr CRITICAL_PAIR(fc,j, i, Gprev)) 

21: Gcurr • — Gcurr ^ 

22: return Gcurr 



Section 2.3. The sets Gcurr, Gprev C N index elements of r that correspond to the 
generators of (Pj) and a Grobner basis of (Pi_i), respectively. 

• The goal of Incremental_Basis is to compute a Grobner basis of (Pj) by com- 
puting d-Grobner bases for d = 1,2, (A rf-Grobner basis is one for which all 

S'-polynomials of homogeneous degree at most d reduce to zero; see (Becker et al., 
1993).) Incremental_Basis iterates the following steps, which follow the general 
outline of Buchberger's Algorithm: 

— Generate a list of critical pairs by iterating Critical_Pair on all of the pairs 
of {curr _idx} x Gprev (In our implementation, curr _idx is the location in r 
where Ji is stored.) 

— Identify the critical pairs of smallest degree, and compute the necessary 5*- 
polynomials of smallest degree using Compute_SPols. 

— Top-reduce by passing the output S of Compute_SPols to Reduction. 

— The output R of Reduction indexes those polynomials that did not reduce 
to zero; new critical pairs are generated by iterating Critical_Pair on all 
pairs {k,j) G P x Gcurr, and R is appended to Gcurr- 

We higlight the major differences between these subalgorithms and their counterparts in 
Buchberger's algorithm: 
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Algorithm 3 Critical Pair 



1: globals <T 

2: inputs 

3: fc, £ e N such that 1 < k < i < #r 

4: i eN 

5: Gprev C N, indices in r of a Grobner basis of (/i, /2, . . . , fi-i) w/respect to <t 

6: outputs 

7: {{t,u,k,v,£)}, corresponding to a critical pair {k,l} necessary for 

8: the computation of a Grobner basis of (/i, /2, • • • , /i); otherwise 

9: do 

10: tk ■■= HM (Poly (fc)) 

11: te := HM (Poly {£)) 

12: t := lcm{tk,te) 

13: Ui := t/tk 

14: U2 ■= t/tf, 

15: TiF^j := Sig (fc) 

16: := Sig (£) 

17: if Vi = i and mi • ti is top-reducible by Gprev 

18: return 

19: if = « and U2 ■ T2 is top-reducible by Gprev 

20: return 

21: if ui ■ Sig (k) ^ U2 ■ Sig {£) 

22: Swap ui and U2 

23: Swap k and ^ 

24: return {{t,k,Ui,£,U2)} 



Algorithm 4 Compute SPols 
1: globals r, <t 
2: inputs 

3: P, a set of critical pairs in the form {t, k, u, £, v) 

4: outputs 

5: S, a list of indices in r of S'-polynomials computed 

6: for a Grobner basis of (/i, /2, . . . , fi) 

7: do 

8: S:=0 

9: for {t, k, u, £, v) G P, from smallest to largest 1cm 

10: if not Is _ Rewritable (m, k) and not Is _ Rewritable {v,£) 

11: Compute s, the S'-polynomial of Poly (fc) and Poly {£) 

12: Append {u ■ Sig (fc) , s) to r 

13: Add_Rule(u- Sig(fc) ,#r) 

14: if s 7^ 

15: Append #r to S 

16: Sort S by increasing signature 

17: return S 
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Algorithm 5 REDUCTION 
1: globals r, <t 
2: inputs 

3: S, a list of indices of polynomials added to the generators Gi 
4: B, a Grobner basis of (/i, /2, . . . , fi-i) with respect to <t 
5: Gprev C N, indices in r corresponding to B 

6: Gcurr C N, indices in r of a list of generators of the ideal of (/i, /2, ■ ■ ■ ,fi) 
7: outputs 

8: completed, a subset of G corresponding to (mostly) top-reduced polynomials 

9: do 

10: to_do:=S 

11: completed := 

12: while to_ do ^ () 

13: Let k be the element of to_ do such that Sig (k) is minimal. 

14: to_ do := to_ do\ {k} 

15: h := Normal_Form (Poly (fc) , B, <t) 

16: rfe := (Sig (fc) , h) 

17: newly_ completed, redo := Top_ReduCTION (fc, Gprevj Gcurr U completed) 

18: completed := completed U newly _ completed 

19: for J G rerfo 

20: Insert j in to_ do , sorting by increasing signature 

21: return completed 



• Critical_Pair discards any pair whoso corresponding 5-polynomial has a com- 
ponent that satisfies the "new criterion" of (Faugere, 2002), described in Section 4.4. 

• COMPUTE_SPOLS disregards any 5-polynomial with a "rewritable" component, as 
described in Section 4.2. 

• Reduction iterates over the most recently computed S'-polynomials, from lowest 
signature to highest. For each k in its input, it: 

— Performs a complete (normal form) reduction of Poly (fc) by the previous Grob- 
ner basis. 

- Invokes Top_Reduction, which top-reduces Poly (A; ) by the current set of 
generators, subject to the following restrictions. 

* Top_Reduction invokes Find_Reductor to find top- reductions. If 
it finds one. Top _ Reduction may act in two different ways, depending 
on the signature of the top-reduction. If the signature is "safe", which 
means "signature-preserving", as discussed at the end of Section 4.1, then 
an ordinary top-reduction takes place. If the signature is "unsafe", then 
Top _ Reduction acts as if it is computing an S'-polynomial, and thus 
generates a new polynomial with the new (higher) signature. 

* Some top-reductions by the current basis are forbidden by Line 16 of 
Find_Reductor. The practical result is that some polynomials in the 
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Algorithm 6 Top Reduction 



globals r, <t 
inputs 

k, the index of a labeled polynomial 

Gprev C N, indices in r of a Grobner basis of (/i, /2, . . . , fi-i) w/respect to <t 
Gcurr C N, indices in r of a list of generators of the ideal of (/i, /2, . . . , fi) 
outputs 

completed, which has value {A:} if was not top-reduced and otherwise 
to_ do, which has value 

if Tfc was not top-reduced, 

{k} if rk is replaced by its top-reduction, and 

{k, #r} if top-reduction of generates a polynomial with a signature larger 
than Sig (fc). 
do 

if Poly (fc) = 

warn "Reduction to zero!" 

return 0,0 
p := Poly (k) 

J := FIND_REDUCT0R (fc, Gprev, Gcurr) 

if J = 

n:^ (sig(A),p-(HC(p))-^) 

return {k} , 

Let j be the single element in J 
q := Poly (j) 

._ HM(p) 
" HM(g) 

c:=HC(p)-(HC(g))-^ 
p := p — c - u - q 
if 

p:=p-(aC{p))-' 
if «-Sig(i) ^Sig(fc) 

rfc := (Sig(fc) ,p) 

return 0, {k} 
else 

Append (u • Sig (j) ,p) to r 
Add _ Rule {u ■ Sig (j) , #r) 
return 0, {k, #r} 
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Algorithm 7 Find_Reductor 
1: globals <T 
2: inputs 

3: k, the index of a labeled polj^nomial 

4: Gprev C N, indices in r of a Grobner basis with respect to <t of (/i, /2, • ■ ■ , fi-i) 
5: Gcurr C N, indices in r of a list of generators of the ideal of (/i, /2, . . . , fi) 

6: outputs 

7: J, where J = {j} if j G Gcurr and Poly (fc) is safely top-reducible by Poly (j); 
8: otherwise J = 

9: do 

10: t := HM (Poly (/e)) 

11: for j e Gcurr 

12: t' = HM(Poly(i)) 

13: if i' I i 

14: U := t/t' 

15: TjF^^. := Sig (j) 

16: if u • Sig (j) ^ Sig (k) and not Is _ Rewritable (u, j) and u ■ tj is not top- 
reducible by Gprev 

17: return {j} 

18: return 



Algorithm 8 Add Rule 
1: globals r, Rule 
2: inputs 

3: rFy, the signature of 

4: k, the index of a labeled polynomial in r (or 0, for a phantom labeled polynomial) 

5: do 

6: Append (r, k) to Rule^ 
7: return 



basis may not be fully top-reduced. These correspond to forbidden ^-poly- 
nomials; compare with lines 17 and 19 of Critical_Pair and line 10 of 

COMPUTE_SPOLS. 

The remaining subalgorithms record and analyze information used by Critical_Pair 
and COMPUTE_SPOLS to discard useless pairs: 

• Add_Rule is invoked whenever Compute_SPols or Reduction generates a 
new polynomial, and records information about that polynomial. 

• Is_Rewritable and Find_Rewriting determine when an ^-polynomial is re- 
writable. 

2.3. Signatures and Labeled Polynomials in F5 

The first major difference between F5 and traditional algorithms to compute a Grob- 
ner basis is the additional record keeping of "signatures". 
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Algorithm 9 Is Rewritable 

1: inputs 

2: u, a power product 

3: k, the index of a labeled polynomial in r 

4: outputs 

5: true if u ■ Sig (k) is rewritable (see Find_ Rewriting) 

6: do 

7: j := Find_Rewriting (u, k) 
8: return j ^ k 



Algorithm 10 Find_Rewriting 
1: globals Rule 
2: inputs 

3: u, a power product 

4: k, the index of a labeled polynomial in r 

5: outputs 

6: j, the index of a labeled polynomial in r such that if tjF^^ = Sig (j) 
and TjFi^^. = Sig (k), then ^'j = z^fc and tj \ u ■ Tk 
and rj was added to Rule^j^ most recently. 

7: do 

8: TfeF^ := Sig (A:) 
9: ctr ^Ruleu 
10: while cir > 

12: if Tj \ U ■ Tk 

13: return j 

14: ctr := ctr — 1 
15: return k 
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Definition 2. Let M G N, G = (.gi, . . . .,9m) e 7^^'', and p e 11. We say that (r,zv) e 
M X N is a signature of p with respect to G ii p has an G-representation h such that 

• hi,+i = hi,+2 = ■ ■ ■ = liM = 0; and 

• r = HM(/i^). 

We omit the phrase "with respect to G" when it is clear from context, and let tF^ be 

a shorthand for (t, j/). We also say that h is a G-representation of p corresponding to 

tFi,. We call v the index. 

We also define the zero signature of the zero polynomial Ogi + 0(72 + • • • + Ogm- 
The labeled polynomial = (Sig {k) , Poly (/e)) is admissible with respect to G if Sig (k) 

is a signature of Poly (k) with respect to G. Again, we omit the phrase "with respect to 

G" when it is clear from context. 

Remark. Our definitions of a signature differ from Faugere's in several respects: 

• The first is minor: wc use = • • • = /m = whereas Faugcrc uses /i = 
••• = = 0. The present version simplifies considerably the description and 
implementation of F5C. 

• Faugere uses (Fi, . . . ,F„) as the basis for the 7?.-module TZ"^ where m is fixed; in 
F5C m usually increases. 

• Faugere's definition admits only one unique signature per polynomial, determined 
by a minimality criterion. Our version allows a polj^nomial to have many signatures; 
we refer to Faugere's signature as the minimal signature of a polynomial. The 
change is motivated by a desire to reflect the algorithm's behavior; for many inputs, 
F5 does not always assign the minimal signature to a polynomial. 

• We introduce a zero signature. 

The algorithm's behavior depends crucially on the assumption that all the elements 
of r are admissible. We show that the algorithm satisfies this property in Proposition 7. 

Example 3. Suppose that F = (xy + a;, j/^ — l). Then (Fi,/i) is admissible with 
respect to F. So is (.TF2, /i), since /i = yfi — .T/2. O 

It will be convenient at times to multiply monomials to signatures; thus for any 
monomial u and any A; € {1, ... , #r} we write the natural signature of the product of u 
and Sig (fc) = rFy as 

MSig(fc) = m-tF„ = {ut)¥^. 

If tF^ is a signature of a polynomial p, then the natural signature of the product of u 
and tFv is a signature of up. For more properties of signatures, see Proposition 7 in 
Section 4.1. 

We now generalize the ordering <t to an ordering on signatures. 

Definition 4. Let iS be the set of all possible signatures with respect to F. Define a 
relation ^ on <S in the following way: for all monomials r, r' € M 



• is smaller than any other signature, and 
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• for all i, j e N r'Fi -< tFj iff 



- i<j, or 

- i = j and r' <t t. 

It is clear that ^ is a well-ordering on <S, which implies that every polynomial has a 
minimal signature. 

Example 5. In Example 3, Fi is the minimal signature of /i with respect to F. '0> 

3. F5C: F5 Computing with reduced Grobner bases 

It turns out that F5 often generates many "redundant" polynomials. For the purposes 
of this discussion, a redundant polynomial in a Grobner basis B is a polynomial p G B 
whose head monomial is divisible by the head monomial of some q S B\ {p}. It is obvious 
from (B) of Theorem 1 that p is unnecessary for the Grobner basis property, and can be 
discarded. In the Example given in (Faugere, 2002) rio, which has head monomial y^t'^, 
is a redundant polynomial because of rg, which has head monomial y^t"^. 

Why does this happen? A glance at line 16 of Find_Reductor reveals that some 
top-reductions are forbidden! Thus, despite the fact that it is often much, much faster 
than other algorithms, F5 still generates many redundant polynomials. Paradoxically, 
we cannot discard such polynomials safely before the algorithm has computed a Grobner 
basis, because the unnecessary polynomials are marked with signatures that are necessary 
for the algorithm's stability and correctness. 

3.1. Introducing F5C 

Stegers introduces a limited use of reduced Grobner bases to F5: variant F5R top- 
reduces by the polynomials of a reduced basis, but continues to compute critical pairs 
and S'-polynomials with the polynomials of the unreduced basis. One can implement this 
relatively easily by changing line 22 of Basis to 

22 Let B be the interreduction of {Poly (A) : A G Gprcv} 

When we say "interreduction", we also mean to multiply so that the head coefficient is 
unity; thus B is the unique reduced Grobner basis of (Fi). Subsequently, Reduction 
will reduce Poly (k) completely by the interreduced B; this does not affect the algorithm's 
correctness because the signature of every polynomial in (B) is smaller than the signature 
of any polynomial generated with 

Why does F5R only top-reduce by the reduced basis, but not compute critical pairs 
and ^-polynomials using the reduced basis? The algorithm needs signatures and poly- 
nomials to correspond, but the signatures of the polynomials of B are unknown. Merely 
replacing the polynomials indexed by Gprcv to those of B would render most polynomials 
inadmissible. The rewritings stored in Rule would no longer correspond to the signatures 
of S-polynomials, so Is_Rewritable would reject some .S-polynomials wrongly, and 
would fail to reject some 5-polynomials when it should. 

Can we get around this? In fact, we can: modify the lists r and Rule so that the 
polynomials of B are admissible, and the rewrite rules valid, with respect to {B) = 
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(Fi). Suppose that Incremental_Basis has terminated with value Gprcv in Basis. As 
in F5R, modify Line 22 of Basis to interreduce {Poly (A) : A G Gprev} and obtain the 
reduced Grobner basis B. The next stage of the algorithm requires the computation of a 
Grobner basis of (Fi+i). Certainly (-Fi+i) = {B U {/i+i}). Reset rand Rule, then create 
new lists to reflect the signatures and rewritings for the corresponding B-representation: 

. r:= ((F,-,i?,))#f,;and 

• for each j = 2, . . . , ^B and for each k = 1, . . . ,j — 1 set Rulej := {<Jp,q, 0)^Zi where 

p = Bj and q = Bk- 

The first statement assigns signatures appropriate for the module 7^#^ ; the second re- 
creates the list of rewritings to reflect that the 5-polynomials of B all reduce to zero. 
The redirection is to a non-existent polynomial rg, which serves as a convenient, fictional 
phantom polynomial; one might say Poly (0) = 0. This reconstruction of r and Rule 
allows the algorithm to avoid needless reductions. (It turns out that the reconstruction 
of Rule is unnecessary. However, this is not obvious, so we leave the step in for the time 
being, and discuss this in Section 4.5.) We have now rewritten the original problem in 
an equivalent form, based on new information. 

Although we address correctness in Section 4.5, let us consider for a moment the 
intuitive reason that this phantom polynomial tq poses no difficulty to correctness. In 
the original F5 algorithm, every 5-polynomial generates a new polynomial in r and a 
corresponding rule in Rule. (See lines 14 and 15 of Compute_SPols, lines 13-15 of 
Top_Reduction, and Hues 19 and 20 of Reduction.) If reduces to zero for some k, 
then k is not added to Gcum but the rewrite rule (Sig (fc) , k) remains in Rule. Thus the 
algorithm never uses Poly (k) again; however, it uses Sig (fc) to avoid computing other 
polynomials with the same signature. The change we propose has the same effect on 
5-polynomials of B: we know a priori that they reduce to zero. We could add a large 
number of entries (Sig (k) , 0) to r, but since the algorithm never uses them we would 
merely waste space. Instead, we redirect the signature Sig (fc) to a phantom polynomial 
ro, which like is never in fact used. 

We call the resulting algorithm FoC, and summarize the modifications in the pseu- 
docode of Algorithms 11 and 12; the first replaces Algorithm 1 entirely. We have sep- 
arated most of the modification of Basis into Setup_Reduced_Basis, a separate 
subalgorithm invoked by Basis/C, the replacement for Basis. 

3.2. Experimental results 

One way to compare the three variants would be to measure the absolute timings 
when computing various benchmark systems. By this metric, F5R generally outperforms 
F5, and F5C generally outperforms F5R: the exceptions are all toy systems, where the 
overhead of repeated interreduction and Setup _ Reduced _ Basis outweigh the benefit 
of using a reduced Grobner basis. Tables 1 and 2 give timings and ratios for the variants 
in two different implementations. 

• Table 1 gives the results from a an implementation written in Python for the Sage 
computer algebra system, version 3.4. Sage is built on several other systems, one 
of which is Singular 3-0-4. Sage calls Singular to perform certain operations, so 
some parts of the implementation run in compiled code, but most of the algorithm is 
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Algorithm 11 Basis/ C 



1: globals r, Rule, <t 

2: inputs 

3: F = (/i, /2, • • • , fm) € 7^'" (homogeneous) 

4: <, an admissible ordering 

5: outputs 

6: a Grobner basis of F with respect to < 

7: do 

8: <T- = < 

9: Sort F by increasing total degree, breaking ties by increasing leading monomial 

10: Rule := List (List ()) 

11: r := List () 

12: Appond (Fi, /i • HC (/i)-') to r 

13: Gprev = {1} 

14: B = {/i} 

15: i := 2 

16: while i < m 

17: Append (f#^+i, • HC (/,)"^) to r 

18: Gcurr := INCREMENTAL_ BASIS (#r, Gprev) 

19: if 3X e Gcurr such that Poly (A) = 1 

20: return {1} 

— The only change to Basis is the addition of this line 

21: Gprcv := SeTUP_REDUCED_BASIS (Gcurr) 

22: B := {Poly (A) : AG Gprev} 

23: i:=i + l 

24: return B 



system 


F5 (soc) 


F5R (sec) 


F5C (sec) 


F5R/F5 


F5C/F5 


Katsura-7 


6-60 


5.09 


4.23 


0.77 


0.64 


Katsiira-8 


111.05 


52.22 


43.88 


0.47 


0.40 


Katsura-9 


5577 


1421 


1228 


0.25 


0.22 


Cyclic-6 


3.91 


3.88 


3.41 


0.99 


0.87 


Cyclic-7 


1182 


505 


381 


0.43 


0.32 


Cyclic-8 


>4 days 


231455 


188497 


N/A 


N/A 



Table 1: Ratios of timings in the Sage (Python) implementation 
All timings obtained using the cputimeO function in a Python implementation in Sage 
3.2.1, on a computer with a 2.66GHz Intel Core 2 Quad (Q9450) running Ubuntu Linux 
with 3GB RAM. The ground field has characteristic 32003. *Computation of CycHc-8 in 
F5 has not terminated on the sixth day of computation, when this draft was committed. 
On other computers, the timing was comparable. 



14 



Algorithm 12 Setup_Reduced_Basis 



1: globals r, Rule, <t 

(modifies r and Rule) 
2: inputs 

3: Gprcv, a list of indices of polynomials in r that correspond to a Grobner basis of 

(/l7 • • • I fi) 
4: outputs 

5: Gcurr C N, indices of polynomials in r that correspond to a reduced Grobner basis 

of (/i,...,/.) 
6: do 

7: Let B be the interreduction of {Poly (fc) : fc € Gprev} 

8: Gcurr '■= {jljLl 

9: r:=List({(F„i?,)}Jf^) 

— Lemma 32 implies that lines 10-15 are unnecessary 

— Al' ' ' ' ' of B reduce to zero; document this 

10: Rule = List (^{List Ojfj'i) 

11: for j := 1 to #B-l 

12: t := HM {Bj) 

13: for fc := j + 1 to #B 

14: u:=lcm(t,HM(5ft))/HM(Bfe) 

15: Add _ Rule (uFfejO) 

16: return Gcurr 



system 


F5 (sec) 


F5R (sec) 


F5C (sec) 


F5R/F5 


F5C/F5 


Katsura-7 


0.30 


0.34 


0.31 


1.13 


1.03 


Katsura-8 


4.05 


4.41 


3.33 


1.09 


0.82 


Katsura-9 


127.14 


142.81 


82.48 


1.12 


0.65 


Schrans-Troost 


25.43 


21.74 


21.43 


0.85 


0.84 


F633 


0.34 


0.40 


0.30 


1.18 


0.88 


F744 


1252 


1132 


1075 


0.90 


0.86 


Cyclic-6 


.04 


.03 


.03 


0.75 


0.75 


Cyclic-7 


6.5 


5.39 


4.35 


0.83 


0.67 


Cyclic-8 


3233 


3101 


2154 


0.96 


0.67 



Table 2: Timings for the (compiled) Singular implementations 
Average of four timings obtained from the getTimerO function in a modified SINGULAR 
3-1-0 kernel, on a computer with a 3.16GHz Intel Xeon (X5460) running Gentoo Linux 
with 64GB RAM. The ground field has characteristic 32003. 
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system 


reductions in F5 


reductions in F5R 


reductions in F5C 


Katsura-4 


774 


289 


222 


Katsura-5 


14597 


5355 


3985 


Katsura-6 


1029614 


77756 


58082 


Cyclic-5 


510 


506 


446 


Cyclic-6 


41333 


23780 


14167 



Table 3: Reductions performed by the three F5 variants over a field of characteristic 32003. 



otherwise implemented in Python. For example, Line 15 of Reduction (reduction 
by the previous basis) is handed off to Singular, while the implementation of 
Top _ Reduction is nearly entirely Python. 

• Table 2 gives the results from a compiled Singular implementation built on the 
Singular 3-1 kernel. This implementation is unsurprisingly much, much faster 
than the Sage implementation. Nevertheless, the implementation is still a work in 
progress, lacking a large number of optimizations. For example, so far polynomials 
are represented by geobuckets (Yap, 2000); the eventual goal is to implement the 
F4-style reduction that Faugere advises for efficiency (Faugere, 1999, 2002). 

Remark. This SINGULAR implementation has one major difference from the pseudocode 
given: its implementation of Top _ Reduction performs safe reductions of non- leading 
monomials as well as of the leading monomials. This helps explain why there seems 
to be no benefit to F5R, unlike the Sage implementation. Another factor is that top- 
reduction in Sage is performed by interpreted Python code, whereas tail reductions are 
performed by the compiled Singular library to which Sage links. Thus, the penalty for 
interreduction, relative to top-reduction, is much lower in Sage, to the benefit of F5R. 

Timings alone are an unsatisfactory metric for this comparison. They depend heavily 
on the efficiency of hidden algorithms, such as the choice of polynomial representation 
(lists, buckets, sparse matrices). It is well-known that the most time-consuming part by 
far of any non-trivial Grobner basis computation consists in the reduction operations: 
top-reduction, inter-reduction, and computing normal forms. This remains true for F5, 
with the additional wrinkle that, as mentioned before, F5 generally computes many more 
polynomials than arc necessary for the Grobner basis. Thus a more accurate comparison 
between the three variants would consider 

• the number of critical pairs considered, 

• the number of polynomials generated, and 

• the number of reduction operations performed. 

We present a few examples with benchmark systems in Tables 3-5, generated from the 
prototype implementation in Sage. In each case, the number of reductions performed 
by F5C remains substantially lower than the number performed by F5R, which is itself 
drastically lower than the number performed by F5. As a reference for comparison, we 
modified the toy implementation of the Gebauer-Moller algorithm that is included with 
the Sage computer algebra system to count all the reduction operations (Gebauer and 
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i 


^ ^curr 


max {d} 


max {#Pd} 


2 


2 


N/A 


N/A 


3 


4 


3 


#^3 = 1 


4 


8 


4 


#^3 = 2 


5 


16 


6 




6 


32 


6 


#P4 = 8 


7 


60 


10 


#P5 = 17 


8 


132 


11 


#P6 = 29 


9 


524 


16 


#P8 = 89 


10 


1165 


13 


#P8 = 276 



Table 4: Internal data of Incremental_ Basis in both F5 and F5R while computing Katsura-9. 



i 




max {d} 


max 


2 


2 


N/A 


N/A 


3 


4 


3 


#P3 = 1 


4 


8 


4 


#P3 = 2 


5 


15 


6 


#P3 = #P4 = 4 


6 


29 


6 


#P4 = #P6 = 6 


7 


51 


10 


#P5 = 12 


8 


109 


11 


#P6 = 29 


9 


472 


16 


#P8 = 71 


10 


778 


13 


#P8 = 89 



Table 5: Internal data of Incremental_Basis/C in F5C while computing Katsura-9. 

Moller, 1988); it performed more than 1,500,000 reductions to compute Cyclic-6. The 
table shows that F5 performed approximately 2.4% of that number, while F5C performed 
approximately 0.7% of that number. 

In general, F5 and F5R will compute the same number of critical pairs and polynomi- 
als, because they are using the same values of Gprev Top-reducing by a reduced Grobner 
basis eliminates the vast majority of reductions, but in F5R Gprcv still indexes polyno- 
mials whose monomials are reducible by other polynomials, including head monomials! 
As a consequence, F5R cannot consider fewer critical pairs or generate fewer polynomials 
than F5. By contrast, F5C has discarded from Gprcv polynomials with redundant head 
monomials, and has eliminated reducible lower order monomials. Correspondingly, there 
is less work to do. 

Example 6. In the Katsura-9 system for F5 and F5R, each pass through the while 
loop of Incremental_Basis generates the internal data shown in Table 4. For F5C, 
each pass through the while loop of Incremental_Basis/C generates the internal 
data shown in Table 5. For each i, F5R and F5C both compute B, the unique reduced 
Grobner basis of F^. This significantly speeds up top- reduction, but F5C replaces r with 
labeled polynomials for B. The consequence is that Gprcv contains fewer elements, leading 
Incremental_Basis/C to generate fewer critical pairs, and hence fewer polynomials 
for Gcurr- Similar behavior occurs in other large systems. 0> 
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4. Correctness of the output of F5 and F5C 

In this section wc prove that if Fo and F5C terminate, then their output is correct. 
Seeing that Faugere has already proved the correctness of F5, why do we include a new 
proof? First, we rely on certain aspects of the proof to explain the modifications that 
led to F5C, so it is convenient to re-present a proof here. Another reason is to present 
a new generalization of Faugere's characterization of a Grobner basis; although it is not 
necessary for F5C, the new characterization is interesting enough to describe here. 

Remark. We do not address the details of termination, nor will we even assert that the 
algorithms do terminate, but in practice we have not encountered any systems that do 
not terminate in F5. 

Having said that, we would like to address an issue with which some readers may be 
familiar. The Magma source code of (Stegers, 2006) implements F5R,. This code is pub- 
licly available, and contains an example system in the file nonTerminatingExample .mag. 
As the reader might expect from the name, this system causes an infinite loop when 
given as input to the source code. Roger Dellaca, Justin Gash, and John Perry traced 
this loop to an error in Top_Reduction. (Lines 32 and 33 were not implemented, 
which sabotages the record-keeping of Rule.) The corrected Magma code terminates 
with the Grobner basis of that system. 

4.1. Properties of signatures 

The primary tool in F5 is the signature of a polynomial (Definition 2). The following 
properties of signatures explain certain choices made by the algorithm. 

Proposition 7. Let p,q G TZ, t,t',u,v G M, and i/,^' G {1, 2, . . . , Af}. Suppose that 
tF^ and t'F^i are signatures of p and q, respectively. Each of the following holds: 

(A) (ur) F,y is a signature of up. 

(B) IfurFi, t'Fi,i, then (ut)F,^ is a signature of up ± vq. 

(C) If {ap^qT)Fi, >- {aq^pT')F,yf , then (cTp^gr) F^ is a signature o/Spol(p, g). 

The proof is straightforward, so we omit it. 

The following proposition implies that the labeled polynomials of r are admissible 
with respect to the input at every moment during the algorithm's execution. 

Proposition 8. Each of the following holds. 

(A) For every k G {1, 2, . . . , #r}, Sig (k) is a signature o/Poly (k) with respect to F when 
rk is defined in Line 12 0/ COMPUTE_SPOLS and Line 32 0/ Top_Reduction. 

(B) After the call 

h := Normal_Form (Poly (fc) , safe, <t) 
in Line 15 of REDUCTION, Sig (k) is a signature of h with respect to F. 

( C) For all k G {1,2, ... , #r}, Sig (fc) remains invariant, and is a signature of Poly (fc) 
with respect to F. 
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The proof follows without difficulty from Proposition 7 and inspection of the algorithms 
that create or modify labeled polynomials: Incremental_Basis, Compute_SPols, 
Reduction, and Top_Reduction. 

Remark. Although Sig (fc) is a signature of Poly(fc), it need not be the minimal sig- 
nature of Poly(fc). For example, if F5 is given the input F = (^xh + ,yh + h"^) then 
COMPUTE_SPOLS computes an S'-polynomial and creates the labeled polynomial 

rg = {xF2, yh^ - xh^) . 

Hence Sig (3) = XF2, but it is also true that 

Spol(/l,/2) = -/l/l + /l/2. 

Thus is also a signature of Poly (3). Since /1F2 -< XF2, XF2 is not the minimal 
signature of /2. 

Definition 9. Let F E TZ"'-; all signatures arc with respect to F. Suppose that tF,j 
is a signature of an S'-polynomial S generated by Poly (a) and Poly (6), and h is an 
^-representation of S such that the natural signatures of the products satisfy 

HM(/iA)Sig(A) ^tF, 

for all VA = l,...,#h except one, say A', in which case HM Sig (A') = tF^ and 
A' > a, b. We call h a signature-preserving ^-representation. 

Proposition 8 implies that top-reductions that do not generate new polynomials cre- 
ate signature-preserving S-representations of S-polynomials. Top-reductions that do 
generate new polj^nomials correspond to new S-polynomials, and the reductions of the 
new polynomials likewise correspond to signature-preserving 5-representations. That 
motivates the following definition. 

Definition 10. If we are at a stage of the algorithm where Compute_SPols generated 
Tfe, but Reduction has not yet reduced it, we say that Reduction is scheduled to 
compute a signature-preserving S -representation. Once it computes the representation, 
we say that the algorithm has computed a signature-preserving reduction to zero. 

4.2. Rewritable Polynomials 

As Faugere illustrates in Section 2 of (Faugere, 2002), linear algebra suggests that 
two rows of the Sylvester matrix of F need not be triangularized if one row has already 
been used in the triangularization of another row. This carries over into the F-represen- 
tations of S-polynomial components, so F5 uses signatures to hunt for such redundant 
components. The structure Rule tracks which signatures have already been computed. 

Definition 11. Let Rule be a list of m lists of tuples of the form p = (r, j). We write 
Rulci for the ith list in Rule. We say that R.ule is a list of rewritings for r if for every 
i = 1, . . . , TO and for every pi ~ (Jt3) G Rulei there exist p,q G TZ such that 

1. p = Poly (a), q = Poly (6) for some a, 6 G Gcurr; 

2. max^ {ap^q ■ Sig (a) , C7,,p • Sig (6)} = tF,; 
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3. j > a,b and the first defined valuo of Poly (j) is Spol {p, q); 

4. there exists (or Reduction is scheduled to compute) a signature-preserving S-ie- 
presentation h of Spol(p, g) such that hj = 1; and 

5. if pt> = (r', j') e Rulci and £' > £, then f > j. 

We call Poly (j) the rewriting of Spol {p, q). 

Remark. When we speak of Spol (p, q), we include any unsafe top-reduction that is com- 
puted in Top_Reduction. 

Proposition 12. Every signature-preserving reduction by F5 of an S -polynomial S to the 
polynomial p (where possibly p = 0) is recorded in some Rule^ by the entry (u ■ Sig (k) ,j) 
where: 

• S = u - Poly (k) — V ■ Poly {£) for some I G Gcurr and appropriate u,v G M; 

• u ■ Sig (fc) y V ■ Sig {£); 

• the first defined value of Poly (j) is S, and the final value of Poly (j) is p; and 

• j>k, i. 

The proof follows from inspection of the algorithms that create and top-reduce poly- 
nomials. 

Proposition 13. At every point during the execution of F5, the global variable Rule 
satisfies Definition 11. 

The proof follows from Proposition 12 and inspection of the algorithms that create 
and modify Rule. 

Definition 14. Let j.k E Gcurr, u G M, and Sig (A:) = tF,j. At any given point during 
the execution of the algorithm we say that the polynomial multiple wPoly (fc) is rewritable 
by Poly (j) in W = Rule^, if 

• k^j; 

• Poly (j) is the rewriting of an S'-polynomial; 

• Sig (j) = r'Fy and r' | ut (note the same index u as Sig (fc)); 

• i'^'ij) — for some a € N; and 

• for any = (r", c) such that t" \ ut, either Wa = Wb or b < a. 

We usually omit some or all of the phrase "by Poly (j) in Rule^." We call Poly (j) the 
rewriter of uPoly (k). 

Proposition 15. Let u S M and k € Gcurr- The following are equivalent. 

(A) uPoly {k) is rewritable in Rule^,, where Sig (fc) = tF,^ for some r € M. 

(B) Is _ Rewritable (u, fc) reiwrns true. 
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The proof follows from inspection of the algorithms that create, inspect, and modify 
Rule. 

Proposition 16. If a polynomial multiple uPoly (k) is rewritable, then the rewriter 
Poly (j) satisfies j > k. 

The proof follows from Definitions 11 (/ > j) and 14 {b < a). 

Proposition 17. Let k G Gcurr- Suppose that a polynomial multiple p = uPoly {k) is 

rewritable by some Poly (j) in Rule^. //REDUCTION terminates, then there exist c € F, 
d € M and hx €71. (for each A € (Gcurr U completed) \ {j}) satisfying 

p = erf- Poly Yl hxPoly{X) (1) 

AG(GcurrUcomp/e£ed)\{j} 

where 

• for all Xe {G curr U completed) \ {j} if h\ ^ then HM {h\) Poly (A) has a signature 
smaller than uSig (fc); and 

• uSig (fc) is a signature o/ cd • Poly (j). 

Remark. It does not necessarily follow that h is an HM (j?)-representation of p. The 
usefulness of Proposition 17 lies in the fact that all polynomials in (1) have a smaller 
signature than p except possibly cd ■ Poly (j). If Poly (j) = then the Proposition still 
holds, since itSig {k) would be a non-minimal signature of the zero polynomial. 

Proof. Assume that Reduction terminates. Let Sig (fc) = tF^. By Definition 2 there 
exist qi, . . . ,qi, G TZ such that 

P=Qifi-\ \-Qufu, 

and HM (g^) = r. Let Sig (j) = t'F,^ and let S be the S'-polynomial that generated 
Poly {j). By Definitions 11 and 14, there exist Hi, ... , H^, G TZ such that 

S=Hifi + --- + H,f, 

and 

• HM {H,) = t', 

• t' I UT, 

• p = {t' ,j) appears in Rule^, 

• and k ^ j. 

Let Q = Gcurr U completed. By Definition 11 and the assumption that Reduction 
terminates, there exists Ti € 7?.*^ such that 

• W is a signature-preserving S-representation of S w.r.t. {Poly (A) : A € G}\ and 

• = 1. 
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Let d be a monomial such that dr' = ut. Thus dSig (j) = uSig{k). Let a = HC (/i^) 
and P = HC {H,y). Note that /? ^ 0, since it comes from an assigned signature. Then 



where 



(gi/i + • • • + q.fu) - ^dS 



,A=1 



dPoly(i)+ Y {^dnx) Foly{X) 



A6a\{i} 



^d-Poly(j)+ Yl ^APoly(A) 
Aea\{j} 



gA - |d (-f^A - T-C\) , if Poly (A) = /fe for some k = l,...,v\ 



(2) 



otherwise. 



Recall that 



HM {q^) =UT = HM [^d-H^ 



and since W is signature-preserving 



a 



RMi -d-Hx] Sig (A) -< dr'F, 



utf, yx€g\{j}. 



Thus for any \ G g\ {j} if hx then HM (hx) Sig (A) ^ ?iSig (k). Recall that rfSig (j) = 
uSig(/c). Let c= oi/f3; then equation (2) satisfies the proposition. □ 

We stumbled on Lemma 18 while trying to resolve a question that arose in our study of 
the pseudocode of (Faugcrc, 2002) and (Stcgcrs, 2006). Among the criteria that they use 
to define a normalized critical pair, they mention that the signatures of the corresponding 
polynomial multiples must be different. However, their pseudocodes for Critical_Pair 
do not check for this! This suggests that they risk generating at least a few critical pairs 
that are not normalized, but we have found that this does not occur in practice. Why 
not? 

Lemma 18. Let k,l e Gcurr with k > i. Let p = Poly (A;), q = Poly (£), and u,v &M. 
If uSig (fc) = vSig {£), then wPoly (£) is rewritable. 

Proof. Assume that uSig (/c) = vSig{i) = tFj^ for some r G M, i/ G 
Since the signature indices are equal at v and fc > ^, p is a rewriting of an S-poly- 
nomial indexed by Rule^, so (Sig (fc) , k) appears in B/ide,, after (Sig {tj ,£) (assuming that 
(Sig (£) ,£) appears at all, which it will not if ^ = u). Hence Find_Rewriting {v,£) ^ £, 
Is_Rewritable {v,£) = true, and t;Sig {£) is rewritable. □ 



4.3. New Characterization of a Grohner Basis. 

Definition 19. A syzygy of F is some H e T?.™ such that Fi F = Hifi- 



■+Hmfm = 0. 
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Proposition 20. Suppose that rF,y is a signature of some p € TZ, and h a corresponding 
F -representation. // rF^ is not the minimal signature of p, then there exists a syzygy H 
of F satisfying each of the following: 

(A) tFi, is a signature ofH-F, and 

(B) (h — H) is an F -representation of p corresponding to the minimal signature. 

Proof. Assume that tF^ is not the minimal signature of p. Suppose that t'Y^i is the 
minimal signature of p. Then 1/ < v. By definition of a signature, there exists h e VJ^ 
such that 

p = hifi-\ h h,yf^, 

HM (/ly) = T, and HM (hx) = for each X = iz+l, . . . ,m. Likewise, there exists h' e TZ"^ 
such that 

P=h'Ji + --- + hi,f,y, 



HM {h'^,) = r', and HM {h'^) = for each X = u' + 1, . . . ,m. Let 



hx -h'x, 1 < A < i/ 
hx, v' < X<v 

0, y < X <m 



for each A = 1, 2, . . . , m; then 



Q=p-p = Y,Hxfx. 



Let H = (Hi, . . . , Hm); observe that 

• H is a syzygy of F; 

• r'Fy' -< rFjx implies that 

— - = --- = h„-H„ = and HM {h,y - H,,) = HM {h'^,) = r'; 

— HM {Hv) ~ T, so rF,y is a signature of H • F, satisfying (A); so 

— (h — H)-F is an F- representation of p corresponding to the minimal signature, 
satisfying (B). 

□ 

Inspection of the algorithms that assign signatures to polynomials shows that F5 
attempts to assign the minimal signature with respect to F of each labeled polynomial 
in r: 

• the signature assigned to each /j of the input is Fj; 

• the signatures assigned to S'-polynomials are, by Proposition 7, the smallest one 
can predict from the information known; and 
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• if top-reduction would increase a polynomial's signature, then Top_Reduction 
generates a new S'-polynomial with that signature, preserving the signature of the 
current polynomial. 

This does not always succeed, but Theorem 21 implies a benefit. 

Theorem 21 (New characterization). Suppose that iteration i o/ INCREMENTAL _ BASIS 
terminates with output Gcurr- Let Q = (Poly (A) : A € Gcurr)- If every S-polynomial S 
of Q satisfies (A) or (B) where 

(A) S has a signature-preserving S -representation with respect to Q; 

(B) a component uPoXy {k) of S satisfies 

(Bl) wSig (A;) has signature index i but is not the minimal signature of uPoly{k); 
or 

(B2) wSig (fc) is rewritable in Rule; 
then Q is a Grobner basis of (Fi). 

Remark. Faugere and Stcgcrs prove a theorem similar to that of Theorem 21 (Theorem 1 
in (Faugere, 2002); Theorem 3.21 in (Stegers, 2006)), but their formulation of the theorem 
does not consider (B2), and their notion of a component's not being "normalized" is less 
general and not quite the same as (Bl). 

Proof. Let S be any S'-polynomial of Q; say S = ip.qp — <Jq^pq where p = Poly (k) and 
q = Poly (£). Let t = 1cm (HM (p) , HM (g)); we have HM (CTp,gp) = HM (a,,pg) = t. We 
outline below an iterative process of rewriting those polynomials of the ^-representation 
of S whose head monomials arc not smaller than t. Some rewritings may introduce 
into the ^-representation new polynomials whose head monomials are also not smaller 
than t. We call both S and these monomial multiples of 5-polynomials "intermediate 
/S-polynomials". 

While intermediate S-polynomials exist in the tj-rcproscntation of 5*: 

1. Let S' be the intermediate S'-polynomial with a component uPoly (a) that has 
maximal signature among all components of intermediate S'-polynomials. 

• If S' satisfies (A), use a signature-preserving S- representation of S' to rewrite 
S and obtain a new ^/-representation of S. 

• If itPoly (a) satisfies (Bl), Proposition 20 implies the existence of a syzygy 
that rewrites the F-representation of uPoly (a) to one that corresponds to its 
minimal signature. Use this syzygy to rewrite uPoly (a) and obtain a new 
CJ-representation of S. 

• Otherwise, uPoly (a) satisfies (B2). Choose the rewriter of wPoly (a) of maxi- 
mal index in Rule to rewrite uPoly (a) in the form indicated by Proposition 17 
and obtain a new ^-representation of S. 

2. Is this new ^-representation of S an S-rcprcscntation with respect to Ql If so, 
stop. If not, there exist intermediate S-polynomials in the ^-representation of S. 
Return to step one. 
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We claim that the iterative process outHned above terminates with an ^-representation 
of S. Define 

• A, the set of components of intermediate S-polj^nomials of Q that satisfy (A); 

• Bi, the set of components of intermediate S'-polynomials of Q that satisfy (Bl); 
and 

• B2, the set of components of intermediate S'-polynomials of Q that satisfy (B2). 
In addition, define 

• M = max^ {uSig (a) : uPoly (a) eAUBiU B2}; 

• N = max^ {wSig (a) : wPoly (a) & B2}; and 

• = max<^ {HM (uPoly (a)) : uPoly (a) e A]. 

After each iteration, J\f < A4 remains invariant, and one of the following occurs. 

• After an intermediate 5-polynomial satisfying (A) is rewritten, the signature- 
preserving representation guarantees that any component of a newly introduced 
intermediate S-polynomial has a signature smaller than uSig(a), except possibly 
one, rfSig (j) for some j E Gcurr and some d € M. By Definition 9 b > a. Thus O 
decreases, and A4 does not increase. 

• After a component ?iPoly (a) satisfying (Bl) is rewritten, by Proposition 20 the sig- 
natures of components of newly introduced intermediate S'-polynomials are smaller 
than uSig (a). Since uPoly (a) was chosen to have maximal signature, A4 decreases. 

• After a component satisfying (B2) is rewritten, by Proposition 17 only the signa- 
ture associated with the rewriter rfPoly (j) has value ?iSig(a), for some j G Gcurr 
and some d G M. By Proposition 16 j > a. We chose the rewriting with max- 
imal index in Rule to rewrite this signature, so if dPoly (j) is a component of a 
newly-introduced intermediate S-polynomial, then it does not satisfy (B2); that is, 
dPoly {j) is not itself rewritable. Thus A4 does not increase, and since uPoly (a) 
was chosen to have maximal signature, TV decreases. 

After each rewriting, one of Ai, Af, or O decreases. Observe that A4 never increases. If 
Af increases (as it can during an (A) or (Bl) rewriting), its new value is no larger than 
that of A4 before the rewriting. If O increases (as it can during a (Bl) or (B2) rewriting) 
then one oi A4 or Af decreases. Thus the only possibility for an infinite loop is the case 
where Af decreases while increasing O, then O decreases while returning Af to its previous 
value. This cannot continue indefinitely, because both (A) and (B2) rewritings increases 
the index in r of the polynomial having signature uSig (a) (since b > a and j > a) and r 
has only finitely many elements. Along with the well-ordering property common to both 
-< and <T, this implies that the iterative process terminates with an S- representation of 
S. □ 
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4.4- Principal Syzygies 

Suppose that all syzygies of F are generated by principal syzygies of the form /jFj — 
/jFj. If Sig {k) is not minimal, then by Proposition 20 some monomial multiple of a 
principal syzygy /i (/^Fj — fjFi) has tlio same signature as Sig (A;). This provides an 
easy test for such a non-minimal signature. 

Definition 22. We say that a polynomial multiple wPoly (fc) satisfies Faugere's criterion 
with respect to Gprev if 

• Sig {k) = tF^; and 

• there exists I G Gprov such that 

— Sig {£) ~ r'Yyi where v' < v; and 

- HM (Poly {£)) divides ut. 

Proposition 23. If a polynomial multiple ttPoly (fc) satisfies Faugere's criterion with 
respect to Gprev then uSig (fc) is not the minimal signature ofuPoly{k). 

Proof. Assume that a polynomial multiple uPoly (fc) satisfies Faugere's criterion with 
respect to Gprev Let p = Poly (fc) and rF^ = Sig (fc), so there exists h S TZ"^ such that 



= • • • = km = 0, and HM {h,j) = t. From the definition of Faugere's criterion, there 
exists £ G Gprov such that HM(Poly(^)) divides ut. Let q = Poly(£). Since I € Gprevi 
there exists H S TZ™ such that i/' < v, 

q = Hifi + • • • + Hmfm, 

H^>+i = ■■■ = = 0, and H^^ ^ 0. Choose d e M such that d ■ HM {q) = ut. Observe 
that 



P = hifi H h /im/, 



up 



u{hifi H h h^f^) 




(3) 



Let 



P = u 



Y,hxfx + iK-ilM{K))-f^ 



La=i 



equation (3) becomes 



up 



P + uRM {K)f, 

P+{UT)-f, 

P+(rf-HM(g))-/, 
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By the distributive and associative properties 



HM 



A=l 



, A=l 



HM 



. A=l 



Let 



g=^/A(i?A/.) and R 



A=l 



E^a/a 



HM 



E^a/a 



iA=l 



I A=l 



We can rewrite equation (4) as 



up = P + dQ- (dR) ■ 

We claim that we have rewritten up with a signature smaller than (wr) F,^. By construc- 
tion, P has a signature smaller than {ut) F,y. By inspection, Q has a signature index no 
greater than v' , so dQ has a signature smaller than (ut)F^. That leaves [dR) ■ f^, and 



HM (dR) = d • HM 



I A=l 



I A=l 



= d • HM (g - HM (q)) 
<r d • HM {q) 

= UT. 

Hence (dR) ■ fi, has a signature smaller than {ut)F^, and up has a signature smaller 
than (ur) F^. That is, uSig (fc) is not the minimal signature of up. □ 

If a polynomial multiple uPoly (k) satisfies Faugere's criterion with respect to Gprev, 
then by Proposition 23 and Theorem 21 we need not compute it. Critical_Pair and 
Find_Reductor discard any polynomial multiple that satisfies Faugere's criterion. 
Thus Theorem 21 and Proposition 23 show that: 

Corollary 24. Given F, the output of the F5 algorithm is a Grohner basis of (F). Also, 
if all the syzygies of F are principal, then F5 does not reduce any polynomials to zero. 

Corollary 24 does not imply: 

• that Fo does not generate redundant polynomials. The example from (Faugere, 
2002) generates one such polynomial (rio). 

• that F5 terminates, at least not obviously. To the contrary, Find_Reductor 
rejects potential reducers that are rewritable or that satisfy Faugere's criterion. As 
a result, the algorithm can compute a Grobner basis, while new polynomials that 
are not completely top-reduced continue to generate new critical pairs. We have 
not observed this in practice. 
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4-5. Correctness of the output of F5C 

We come now to the correctness of F5C. For correctness, we argue that each stage of 
F5C imitates the behavior of F5 on an input equivalent to the data structures generated 
by Setup_Reduced_Basis. Recall that Fi = (/i, . . . , /j). We will refer to the system 
F' = {Bi,..., B^bJi+i) where 

• _B is computed during the execution of Setup_Reduced_Basis; and 

• F' is indexed as F/ = Bi, etc. 

It is trivial that {B) = (F,) and {F') = 

Lemma 25. When Setup_Reduced_Basis terminates, every element of r is admis- 
sible with respect to B, and thus with respect to F' . 

The proof is evident from inspection of Setup_Reduced_Basis. 

The correctness of the behavior of Is_Rewritable in F5C hinges on Definition 26. 

Definition 26. Let f G M and k G Gcurr- At any point in the algorithm, we say 
that a polynomial multiple tPoly (fc) is rewritable by the zero polynomial if there exist 
a,b G Gprev such that 

• the iS-polynomial S oi p = Poly (a) and q = Poly (b) reduces to zero, although the 
reduction may not be signature-safe; and 

• max (cTp, gSig (a) , aq^pSig (6)) divides tSig {k). 

Remark. It is essential that a,b G Gprev and not in Gcurr- The fact that a component 
of an S'-polynomial is rewritable docs not imply that it is rewritable by the zero polyno- 
mial. Proposition 17 implies that if a component of an 5-polynomial is rewritable, then 
the jS-polynomial can be rewritten using a polynomial of the same signature; however, 
the resulting iS-representation may not yet exist when the component is detected to be 
rewritable. 

Lemma 27. When Setup _ REDUCED _ BASIS terminates. Is _ Rewritable in F5C 
would return true for the input {u,k), only if uPoly {k) is rewritable by the zero polyno- 
mial. 

Proof. Line 7 of Setup _ Reduced _ Basis intcrreduces the polj'nomials indexed by 
Gprev to obtain the reduced Grobner basis B. Thus all S'-polynomials of B are rewritable 
by the zero polynomial. When Setup _ Reduced _ Basis terminates. Rule consists of a 
list of lists. Elements of the jtli list have the form uj^ = (cB.,Sfc,0) for k = 1, . . . ,j — 1 
where, as explained in the introduction, 

_ 1cm (HM (Bj) , HM (5^)) 
~ HM (Bj) ■ 

Thus if Is _ Rewritable (u, fc) is true, then uPoly(A;) is rewritable by the zero polyno- 
mial. □ 

Corollary 28. In F5C, «/ Is _ REWRITABLE returns true for the input {u,k), then 
wPoly (fc) is rewritable either by a polynomial that appears in r, or by the zero poly- 
nomial. 
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Proof. This is evident from consequence of Proposition 15 and the isolation of ah modifi- 
cations of F5 to Setup_Reduced_Basis. Let j — Find_Rewriting (u, fc). If j = 0, 
Lemma 27 impHes that wPoly (k) is rewritable by the zero polynomial. Otherwise, line 10 
of Setup _ Reduced _ Basis impHes that j G Gcurr\Gprov That is, rj was generated in 
the same way that F5 would generate it. By Proposition 15, uPoly (fc) is rewritable by 
Poly(i). □ 

Theorem 29. 7/ INCREMENTAL _Basis/C terminates for a given input i, then it ter- 
minates with a Grohner basis of 

Proof. The proof is adapted easily from the proof of Theorem 21, using Lemma 25 and 
Corollary 28. In particular, S'-polynomials that are rewritable by the zero polynomial — 
that is, the S'-polynomials of B — can be rewritten in the same manner as polynomials 
that satisfy case (A) of Theorem 21. □ 

Changing the algorithm's point of view so that some polynomials are admissible with 
respect to F' and not to F implies the possibility of introducing non-principal syzygies. 
Of course we would like F5C to avoid any reductions to zero that F5 also avoids; otherwise 
the benefit from a reduced Grobner basis could be offset by the increased cost of wasted 
computations. Hence we must show that if the syzygies of the input F are all principal, 
then F5C does not introduce reductions to zero. Lemma 30 shows that the signature of 
a polynomial indexed by Gcurr\'5prov in F5C corresponds to the signature that F5 would 
compute, "translated" by — {i — 1). 

Lemma 30. Let i > 2. During the ith pass through the while loop of Basis/C, let 
k S (jcurr\Gprev) 0''nd Slg (A)) = tFj^, where the signature is with respect to F' . Then 
(rFj, Poly (A;)) is admissible with respect to F. 

Proof. From the assumption that Sig(fc) = tF^,, we know that there exists h S 7?. such 
that 

m 

Poly {k) = J2hxFi, 

A=l 

h^+i = ■ ■ ■ = km = 0, and HM (h^) = t. Recall that F'^ = B\ for each A = 1, . . . ,1/ — 1. 
By Theorem 29, there exist Hi, . . . ,Hi-i such that 

u—l rn 



A=l A=l 

and iJy = . . . = Hm = 0. In addition, F[, = f^. Hence 



Poly(/c) = ^iJA/A + /l./z, 



A=l 



whence (rFj, Poly (A;)) is admissible with respect to F. □ 

Theorem 31. If the syzygies of F are all principal syzygies, then F5C does not reduce 
any polynomial to zero. 
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Proof. Assume for the contrapositive that k <E Gcurr and the algorithm reduces Poly (fc) to 
zero. Suppose that we are on iteration z of the while loop of Basis/C. Let Sig (fc) =tF^. 
This signature of Poly (fc) is with respect to F'; from Lemma 30 we infer that rFj is a 
signature of Poly (fc) with respect to F. 

Now Gprov indexes a reduced Grobner basis B of (Fi). The reduction to zero implies 
that Critical_Pair did not discard the corresponding critical pair, which in turn im- 
plies that no head monomial of B divided r. By the definition of a reduced Grobner basis, 
no head monomial of the unreduced basis would have divided r either. By Corollary 24, 
the syzygies of F are not principal. □ 

Remark. In our experiments with inputs whose syzygies are not principal, it remains 
the case that F5C computes no more reductions to zero than docs F5. However, we do 
not have a proof of this. The difficulty lies in the fact that signatures of polynomials in 
Gprev need not be the same in F5 and F5C. F5 computes different critical pairs, which 
may generate different rewrite rules. This introduces the possibility that F5 rejects some 
polynomials as rewritable that F5C does not. However, we have not observed this in 
practice. 

We conclude with two final, surprising results. 

Theorem 32. In Setup_Reduced_Basis, there is no need to recompute the rewrite 
rules for B. 

Proof. When performing top-reductions by elements of B, the algorithm checks neither 
whether a polynomial multiple is rewritable, nor whether it satisfies Faugere's criterion. 
Thus we only need to verify the statement of the theorem in the context of S'-polynomial 
creation. Suppose therefore that we are computing Gi, the Grobner basis of {F[) where 
Fl = {Bi, . . . , B^B, fi), and while computing the S'-polynomial oi p = Poly (fc) and 
q = Poly (f), where fc e Gcurr\ Gprev and £ e Gprev, Is_Rewritable reports that ag^pQ 
is rewritable. 

We claim that it will also reject ap^qp. Since (Jq^pQ is rewritable, there exists j g 
{1, . . . such that 

lcm(HM(g),(HM(E,))) 1cm (HM (p) , EM (g)) 

HM(g) HM(g) 

It follows that 1cm (HM (q) , HM (Bj)) divides 1cm (HM (p) , HM (q)). A straightforward 
argument on the degrees of the variables implies that 1cm (HM (p) , HM (Bj)) also divides 
1cm (HM {p) , HM {q)). Thus 

lcm(HM(p),HM(g,.)) lcm(HM(p) ,HM(g)) _ 

HM(p) HM(p) 

The design of the algorithm implies that the S-polynomial of p and Bj would have been 
considered before the S-polynomial of p and q. This leads to two possibilities. 

1. The S-polynomial of p and Bj was computed, so that the rewrite rule (crj,,B^, A) 
appears in Rulei for some A S Gcurr- Hence Is_Rewritable {(Tp^q, fc) returns true. 

2. The S-polynomial of p and Bj was rejected, either because (Jp s^P is rewritable or 
because it satisfies Faugere's criterion. Either one implies that the ap^qp will also 
be rejected. 
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Hence there is no need to compute the rewrite rules for B. 



□ 



Corollary 33. We can reformulate F5C so that Setup_Reduced_Basis is unneces- 
sary, and the list Rule records only signatures of polynomials indexed by Gcurr\(jprev- 

Proof. Theorem 32 impHes that we do not need the signatures of polynomials indexed by 
Gprov for the rewrite rules. In fact, this is the only reason we might need their signatures, 
since Compute_SPols always uses the larger signature to create an S'-polynomial, and 
Top_Reduction top-reduces by B without checking signatures. Hence the signatures 
of polynomials indexed by Gprcv are useless. We now indicate how to revise the algorithm 
to take this into account. 

As in F5R, replace line 22 of Basis with 

22 Let B be the interreduction of {Poly (A) : A £ Gprev}- 

Subsequently, change Hne 17 of Critical_Pair to 

17 if fc ^ Gprev and Ui ■ ri is top-reducible by Gprev 
and line 19 of Critical_Pair to 

19 if i ^ Gprev and U2 ■ T2 is top-reducible by Gprev 

Similarly adjust line 10 of Compute_SPols and line 16 of Find_Reductor so that 
they do not check polynomials of Gprev Modify the definition of Rule so that it is only 
one list, not a list of lists, and Find _ Rewriting so that it only searches backwards 
through Rule, rather than finding which list in Rule to check. Theorem 32 implies that if 
the original F5C terminates correctly, then this modified version of F5C also terminates 
correctly. □ 

Remark. Theorem 32 applies only to F5C, not to F5. The difference is that for any 
£ e Gprev, F5C guarantees that Sig {£) — tFi where r = 1. This is not the case in F5. 

The prototype implementations of F5C are primarily for educational purposes, so for 
the sake of clarity we implement the given pseudocode without the optimization outlined 
in the proof of Corollary 33. 
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Figure 1: Example run of the Singular prototype system 

> LIB "f5_library.lib"; 

// ** loaded f 5_library . lib (1.1,2009/01/26") 

> ring R = 0, (x,y,z,t) ,dp; 

> ideal i = yz3 - x2t2, xz2 - y2t , x2y - z2t; 

> ideal B = basis (i); 
Iteration 2 

Processing 1 critical pairs of degree 5 
Processing 1 critical pairs of degree 7 
4 polynomials in basis 
Iteration 3 

Processing 1 critical pairs of degree 5 
Processing 1 critical pairs of degree 6 
Processing 4 critical pairs of degree 7 
Processing 1 critical pairs of degree 8 
10 polynomials in basis 

number of zero reductions: 

number of elements in g: 10 

cpu time for gb computation: 50/1000 sec 

> B; 

B[l]=yz3-x2t2 

B[2]=x2y-z2t 

B[3]=xz2-y2t 

B[4] =xy3t-z4t 

B[5]=z6t-y5t2 

B[6]=y3zt-x3t2 

B[7]=z5t-x4t2 

B[8]=y5t2-x4zt2 

B[9]=x5t2-y2z3t2 

B[10]=y6t2-xy2zt4 

> 
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Appendix: Using the SINGULAR and Sage prototype implementations 

The Singular prototype implementation contains three functions basis, basis_r, 
and basis_c to compute the Grobner basis of an ideaL An example run with basis is 
shown in Figure 1. While computing the Grobner basis, this implementation also prints 
for each degree the size of Pj, the set of critical pairs passed to Compute_SPols. 
This implementation checks in both Critical_Pair and Compute_SPols for the 
rewritten criterion, so #Pd is sometimes smaller here than in Faugere's paper, but the 
reader can compare the results to sec that the same basis is generated. A large number 
of benchmark systems can be obtained by downloading the companion file 

http : //www . math . usm . edu/perry/Research/f Sex . lib . 

For a further introduction to SINGULAR, see (Greuel and Pfistcr, 2008). 

The Sage prototype implementation contains four classes, F5, F5R, F5C, and F4F5. 
These can be called by creating the appropriate class with a Sage ideal. An example run 
with F4F5 is shown in Figure 2. As in the SINGULAR implementation, run-time data is 
printed. In this case, the number of critical pairs in P^, the number of polynomials gen- 
erated by COMPUTE_SPOLS, and the size of the matrix used for Gaussian elimination. 
No special techniques are used for sparse matrices in this version, so it is rather slow (in 
fact, it is slower than the other F5's). The reader should notice that in this version, the 
output has been interreduced, so there are only 8 polynomials in the final result. For 
more information on Sage, visit 

http://www.sagemath.org/ . 
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Figure 2: Example run of the Sage prototype implementation 
sage: attach "/home/perry/common/Research/SAGE_programs/f 5 .py" 
sage: f5 = F4F5() 
sage: R.<x,y,z,t> = QQ[] 

sage: I = R. ideal (y*z~3-x~2*t~2, x*z~2 - y~2*t, x~2*y - z~2*t) 

sage: B = f5(I) 

Increment 1 

1 critical pairs 

Processing 1 pairs of degree 5 of 1 total 

1 polynomials generated 

1 X 2, 1, 

1 polynomials left 

Processing 1 pairs of degree 7 of 1 total 

1 polynomials generated 

1 X 2, 1, 

1 polynomials left 

Ended with 4 polynomials 

Increment 2 

4 critical pairs 

Processing 1 pairs of degree 5 of 4 total 

1 polynomials generated 

1 X 2, 1, 

1 polynomials left 

Processing 2 pairs of degree 6 of 6 total 
1 polynomials generated 
1 X 2, 1, 

1 polynomials left 

Processing 4 pairs of degree 7 of 6 total 

2 polynomials generated 
4 X 6, 4, 

2 polynomials left 

Processing 2 pairs of degree 8 of 2 total 

1 polynomials generated 

2 X 3, 2, 

1 polynomials left 
Ended with 10 polynomials 
sage : B 
[x*z~2 - y~2*t, 
x~2*y - z~2+t, 
x*y~3*t - z~4*t, 
y+z~3 - x~2+t~2, 
y~3+z+t - x~3+t~2, 
z~5*t - x~4*t~2, 
y-5*t~2 - x~4*z*t~2, 
x~5+t~2 - z~2*t~5] 
sage : 
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